===================================================== BUG: KMSAN: kernel-infoleak in kmsan_copy_to_user+0x9c/0xb0 mm/kmsan/kmsan_hooks.c:253 CPU: 0 PID: 14081 Comm: syz-executor.1 Not tainted 5.9.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:122 kmsan_internal_check_memory+0x202/0x520 mm/kmsan/kmsan.c:410 kmsan_copy_to_user+0x9c/0xb0 mm/kmsan/kmsan_hooks.c:253 instrument_copy_to_user include/linux/instrumented.h:91 [inline] copyout lib/iov_iter.c:143 [inline] copy_page_to_iter_iovec lib/iov_iter.c:216 [inline] copy_page_to_iter+0xacf/0x2220 lib/iov_iter.c:925 pipe_read+0x95f/0x2310 fs/pipe.c:290 call_read_iter include/linux/fs.h:1876 [inline] new_sync_read fs/read_write.c:415 [inline] vfs_read+0x1397/0x15a0 fs/read_write.c:481 ksys_read+0x2af/0x4d0 fs/read_write.c:615 __do_sys_read fs/read_write.c:625 [inline] __se_sys_read+0x92/0xb0 fs/read_write.c:623 __ia32_sys_read+0x4a/0x70 fs/read_write.c:623 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline] __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f3a549 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000f55130cc EFLAGS: 00000296 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000020003340 RDX: 0000000000000060 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:129 [inline] kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:297 kmsan_memcpy_memmove_metadata+0x25e/0x2d0 mm/kmsan/kmsan.c:234 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:254 __msan_memcpy+0x46/0x60 mm/kmsan/kmsan_instr.c:114 memcpy_to_page lib/iov_iter.c:476 [inline] copy_pipe_to_iter lib/iov_iter.c:572 [inline] _copy_to_iter+0x112e/0x2f20 lib/iov_iter.c:629 copy_to_iter include/linux/uio.h:137 [inline] simple_copy_to_iter+0xf6/0x150 net/core/datagram.c:519 __skb_datagram_iter+0x2d1/0x1260 net/core/datagram.c:425 skb_copy_datagram_iter+0xd8/0x280 net/core/datagram.c:533 skb_copy_datagram_msg include/linux/skbuff.h:3527 [inline] packet_recvmsg+0x763/0x2070 net/packet/af_packet.c:3388 sock_recvmsg_nosec net/socket.c:885 [inline] sock_recvmsg net/socket.c:903 [inline] sock_read_iter+0x589/0x610 net/socket.c:976 call_read_iter include/linux/fs.h:1876 [inline] generic_file_splice_read+0x74f/0xb70 fs/splice.c:312 sock_splice_read+0x241/0x250 net/socket.c:954 do_splice_to fs/splice.c:870 [inline] do_splice+0x34d1/0x39c0 fs/splice.c:1179 __do_sys_splice fs/splice.c:1419 [inline] __se_sys_splice+0x323/0x500 fs/splice.c:1401 __ia32_sys_splice+0x6e/0x90 fs/splice.c:1401 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline] __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:129 [inline] kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:297 kmsan_memcpy_memmove_metadata+0x25e/0x2d0 mm/kmsan/kmsan.c:234 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:254 __msan_memcpy+0x46/0x60 mm/kmsan/kmsan_instr.c:114 pskb_expand_head+0x3eb/0x1df0 net/core/skbuff.c:1638 __skb_cow include/linux/skbuff.h:3160 [inline] skb_cow_head include/linux/skbuff.h:3194 [inline] batadv_skb_head_push+0x2ce/0x410 net/batman-adv/soft-interface.c:75 batadv_send_skb_packet+0x1ed/0x970 net/batman-adv/send.c:86 batadv_send_broadcast_skb+0x76/0x90 net/batman-adv/send.c:127 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:419 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0xb3a/0xf00 net/batman-adv/bat_iv_ogm.c:1711 process_one_work+0x1224/0x20a0 kernel/workqueue.c:2269 worker_thread+0x10cc/0x2740 kernel/workqueue.c:2415 kthread+0x51c/0x560 kernel/kthread.c:293 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Uninit was created at: kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:129 kmsan_alloc_page+0xd3/0x1f0 mm/kmsan/kmsan_shadow.c:278 __alloc_pages_nodemask+0x84e/0x1040 mm/page_alloc.c:4938 __alloc_pages include/linux/gfp.h:509 [inline] __alloc_pages_node include/linux/gfp.h:522 [inline] alloc_pages_node include/linux/gfp.h:536 [inline] __page_frag_cache_refill mm/page_alloc.c:5011 [inline] page_frag_alloc+0x35b/0x890 mm/page_alloc.c:5041 __netdev_alloc_skb+0xbee/0xc50 net/core/skbuff.c:456 netdev_alloc_skb include/linux/skbuff.h:2821 [inline] dev_alloc_skb include/linux/skbuff.h:2834 [inline] __ieee80211_beacon_get+0x36cf/0x4c50 net/mac80211/tx.c:4819 ieee80211_beacon_get_tim+0x10f/0x810 net/mac80211/tx.c:4933 ieee80211_beacon_get include/net/mac80211.h:4845 [inline] mac80211_hwsim_beacon_tx+0x1c3/0xb80 drivers/net/wireless/mac80211_hwsim.c:1676 __iterate_interfaces net/mac80211/util.c:737 [inline] ieee80211_iterate_active_interfaces_atomic+0x381/0x5f0 net/mac80211/util.c:773 mac80211_hwsim_beacon+0x11d/0x2e0 drivers/net/wireless/mac80211_hwsim.c:1717 __run_hrtimer+0x478/0xec0 kernel/time/hrtimer.c:1524 __hrtimer_run_queues kernel/time/hrtimer.c:1588 [inline] hrtimer_run_softirq+0x3bf/0x690 kernel/time/hrtimer.c:1605 __do_softirq+0x1b9/0x7ed kernel/softirq.c:298 Bytes 52-53 of 74 are uninitialized Memory access of size 74 starts at ffff8881f4f0f000 Data copied to user address 0000000020003340 =====================================================